What is a Web Application Firewall (WAF), and what can and can't it do?

Summary

A WAF inspects HTTP traffic (at a CDN, load balancer or reverse proxy) and blocks requests matching attack patterns (SQLi, XSS, known exploits), bad bots and abusive rates, using managed rule sets (e.g., OWASP Core Rule Set) and custom rules.

Longer Answer

WAFs are a valuable layer: they provide virtual patching for newly disclosed vulnerabilities, rate limiting, geo/IP rules and bot management. But they can't understand your business logic (IDOR, broken access control), can be bypassed by encoding tricks, and produce false positives that need tuning. Treat a WAF as defense in depth, not a substitute for secure code. Examples: AWS WAF, Cloudflare, Akamai, Azure Front Door/App Gateway WAF, ModSecurity/Coraza.

Key Points

• Filters malicious HTTP traffic
• Managed rules + custom rules
• Virtual patching, rate limits, bot control
• Can't fix authorization bugs
• Needs tuning for false positives